Analysis of role reachability with transitive tags

Patent metadata

Field	Value
Publication number	US-12034727-B2
Application number	US-202017119855-A
Country	US
Kind code	B2
Filing date	Dec 11, 2020
Priority date	Dec 10, 2020
Publication date	Jul 9, 2024
Grant date	Jul 9, 2024

Abstract

Methods, systems, and computer-readable media for analysis of role reachability with transitive tags are disclosed. An access control analyzer determines a graph including nodes and edges. The nodes represent roles in a provider network hosting resources. The roles are associated with access control policies granting or denying access to individual resources. One or more of the access control policies grant or deny access based (at least in part) on key-value attributes. The access control analyzer determines, based (at least in part) on a role reachability analysis of the graph, whether a first role can assume a second role using role assumption steps for a particular state of the attributes. The attributes may include transitive attributes that persist during the role assumption steps.

First claim

What is claimed is:

1. A system, comprising:
an access control analyzer comprising one or more processors and one or more memories to store computer-executable instructions that, when executed, cause the one or more processors to:
determine a graph comprising a plurality of nodes and one or more directed edges, wherein one or more of the directed edges represent role assumption transitions, wherein the nodes represent a plurality of roles in a provider network hosting a plurality of services and resources, wherein the nodes comprise a first node representing a first role and a second node representing a second role, wherein the roles are assumable by clients or other roles for role sessions and are associated with a plurality of access control policies granting or denying access, based at least in part on one or more key-value tags for a role session, to individual ones of the plurality of services and resources for a role session during which the role is assumed; and
determine, based at least in part on a role reachability analysis of the graph, whether the first role can assume the second role using one or more role assumption steps for a particular state of the one or more key-value tags, wherein an individual one of the role assumption steps provides temporary access during a role session, and wherein the one or more key-value tags comprise one or more transitive tags that persist during the one or more role assumption steps.

2. The system as recited in claim 1 , wherein the access control policies permit the first role to assume the second role if the first role provides a session tag matching a condition associated with the second role.

3. The system as recited in claim 2 , wherein the condition associated with the second role comprises one or more wildcards for a value of a key.

4. The system as recited in claim 1 , wherein the graph is determined by finding one or more neighbors for a particular node in the graph based at least in part on a set of the key-value tags whose keys are explicitly indicated with corresponding conditions in the access control policies or by underspecified key-value tags whose values are unrestricted or partially restricted.

5. A method, comprising:
determining, by an access control analyzer, a graph comprising a plurality of nodes and one or more edges, wherein one or more of the edges represent role assumption transitions, wherein the nodes represent a plurality of roles in a provider network hosting a plurality of resources, wherein the nodes comprise a first node representing a first role and a second node representing a second role, wherein the roles are assumable by clients or other roles for role sessions and are associated with a plurality of access control policies granting or denying access, based at least in part on one or more key-value tags for a role session, to individual ones of the plurality of resources for a role session during which the role is assumed; and
determining, by the access control analyzer based at least in part on a role reachability analysis of the graph, whether the first role can assume the second role using one or more role assumption steps for a particular state of the one or more key-value tags, and wherein the one or more key-value tags comprise one or more transitive key-value tags that persist during the one or more role assumption steps.

6. The method as recited in claim 5 , one or more neighbors for a particular node in the graph are determined based at least in part on underspecified key-value tags whose values are unrestricted or partially restricted.

7. The method as recited in claim 5 , wherein one or more neighbors for a particular node in the graph are determined based at least in part on a set of the key-value tags whose keys are explicitly indicated with corresponding conditions in the access control policies.

8. The method as recited in claim 5 , wherein the access control policies permit the first role to assume the second role if the first role provides a session key-value tag matching a condition associated with the second role.

9. The method as recited in claim 8 , wherein the condition associated with the second role comprises one or more wildcards for a value of a key.

10. The method as recited in claim 5 , further comprising:
aggregating one or more boundary conditions for the one or more key-value tags, wherein the one or more boundary conditions are indicated by one or more of the access control policies associated with the one or more role assumption steps.

11. The method as recited in claim 7 , wherein the first role is in a first account with the provider network, and wherein the second role is in a second account with the provider network.

12. The method as recited in claim 7 , further comprising:
based at least in part on determining that the first role can assume the second role, generating a notification of a security finding regarding a configuration of the access control policies.

13. One or more non-transitory computer-readable storage media storing program instructions that, when executed on or across one or more processors, perform:
determining, by an access control analyzer, a graph comprising a plurality of nodes and one or more edges, wherein one or more of the edges represent role assumption transitions, wherein the nodes represent a plurality of roles in a provider network hosting a plurality of services or resources, wherein the nodes comprise a first node representing a first role and a second node representing a second role, wherein the roles are assumable by clients or other roles for role sessions and are associated with a plurality of access control policies granting or denying access, based at least in part on one or more key-value tags for a role session, to individual ones of the plurality of services or resources for a role session during which the role is assumed; and
determining, by the access control analyzer based at least in part on a role reachability analysis of the graph, whether the first role can assume the second role using one or more role assumption steps for a particular state of the one or more tags, and wherein the one or more tags comprise one or more transitive tags that persist during the one or more role assumption steps.

14. The one or more non-transitory computer-readable storage media as recited in claim 13 , wherein the access control policies permit the first role to assume the second role if the first role provides a session tag matching a condition associated with the second role.

15. The one or more non-transitory computer-readable storage media as recited in claim 14 , wherein the condition associated with the second role does not comprise one or more wildcards for a value for a key.

16. The one or more non-transitory computer-readable storage media as recited in claim 13 , further comprising additional program instructions that, when executed on or across the one or more processors, perform:
aggregating one or more boundary conditions for the one or more key-value tags, wherein the one or more boundary conditions are indicated by one or more of the access control policies associated with the one or more role assumption steps.

17. The one or more non-transitory computer-readable storage media as recited in claim 13 , wherein the graph is determined based at least in part on one or more of the tags having keys that are explicitly indicated in the access control policies.

18. The one or more non-transitory computer-readable storage media as recited in claim 13 , wherein the graph is determined based at least in pa

Assignees

• Amazon Tech Inc

Inventors

• Cook John Byron
• Rungta Neha
• Varming Carsten
• Peebles Daniel George
• Kroening Daniel
• Naser Pastoriza Alejandro

Classifications

• H04L63/105

  Multiple levels of security · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L41/22 Primary

  comprising specially adapted graphical user interfaces [GUI] · CPC title

• H04L41/0627

  by acting on the notification or alarm source · CPC title

• H04L63/0435

  wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06) · CPC title